Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8d48639509ae03a…

MALICIOUS

PDF

52.4 KB Created: 2020-08-30 22:06:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ac68abfe350e4801aad60b48857c2549 SHA-1: 56c3f2681b93a46073d4e7a0f9a7d1640abfc729 SHA-256: c8d48639509ae03a146b3963467749c07dfdcd329b744847746f24806cac23e3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link farm and a direct link to a known malicious redirector, disguised with a plausible worksheet title. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK strongly indicates malicious intent. The PDF_SEO_LINK_FARM heuristic suggests the document is part of a larger scheme to distribute malicious links. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=lesson+6.3+arcs+and+angles+worksheet+answers
    • https://cdn.shopify.com/s/files/1/0430/4768/2201/files/sonokejaxikuver.pdf
    • https://cdn.shopify.com/s/files/1/0436/8164/4697/files/56542527421.pdf
    • https://cdn.shopify.com/s/files/1/0431/6381/1999/files/automatizacion_industrial_definicion.pdf
    • https://cdn.shopify.com/s/files/1/0431/4356/1373/files/40785377594.pdf
    • https://cdn.shopify.com/s/files/1/0436/0755/6258/files/wewukiwefopob.pdf
    • https://static.usrfiles.com/ugd/3f4b99_a7bbfab454be40fdae1564a965b509d3.pdf
    • https://static.usrfiles.com/ugd/fb83f1_0f1c2f32d1704de4afa4bb562e7f2cd6.pdf
    • https://static.usrfiles.com/ugd/b8c837_cc7a68105eab4662814b48350b85eaa7.pdf
    • https://cdn.shopify.com/s/files/1/0438/5724/8421/files/68201287549.pdf
    • https://cdn.shopify.com/s/files/1/0457/3164/3558/files/lion_king_2_songs_english.pdf
    • https://cdn.shopify.com/s/files/1/0435/7944/1307/files/54209235032.pdf
    • https://cdn.shopify.com/s/files/1/0430/3526/3130/files/60474775370.pdf
    • https://cdn.shopify.com/s/files/1/0435/2540/6874/files/kidakebesoborijofe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008d5e.bin
b84aee718f4505b9a64c4b9b0a22c9c23cc2ebd7081f27801fe6770a0b6812b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D5E 5648 bytes
font_01_sfnt_off0000a099.bin
cb2f15aff8ed857ecaa4da54e90bc99e3838dbe22a663ab9b5359fa2fa147620		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA099 10476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.